A security flaw has been discovered in vgmstream up to r2117. This affects the function parse_params/txtp_parse of the file src/meta/txtp_parser.c of the component TXTP File Handler. The manipulation results in out-of-bounds write.
The attack may be launched remotely. The patch is identified as 4669d37a6af94866f6f0628678f9f90d46954e8b. It is best practice to apply a patch to resolve this issue.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
n/a:vgmstream
References 7
https://vuldb.com/vuln/413455
VDB-413455 | vgmstream TXTP File txtp_parser.c txtp_parse out-of-bounds write
https://vuldb.com/vuln/413455/cti
VDB-413455 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/cve/CVE-2026-105248
CVE-2026-105248 | CVE Analysis and Report
https://vuldb.com/submit/976278
Submit #976278 | vgmstream r2117 Buffer Overflow
https://github.com/vgmstream/vgmstream/issues/1997
NVD
https://github.com/vgmstream/vgmstream/commit/4669d37a6af94866f6f0628678f9f90d4…
NVD
https://github.com/vgmstream/vgmstream/
NVD